Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re: gee I wonder (Score 0) 118

It's a spambot. It posts links in order to make them appear higher in Google rankings, along with AI-generated "context" designed to fool Google into thinking the link has been legitimately shared.

Comment Oh, and spoiler alert (Score 2) 30

The main character finds Cortana just as obnoxious as the rest of us do. He's had her rammed down his throat just like "we" have, and can't get her to shut the hell up. So in that regard, the show is extremely relatable. I say "we" when referring to the family's computer (or, the very rare Windows VM for an obscure vendor tool) because Linux since 2003.

Comment Yeah I saw it. And it wasn't as bad as they say (Score 3, Interesting) 30

I saw the first season. No, it wasn't as terrible as they say. Apart from "omg it isn't like the game!!", it's actually a fairly solid. A bit brooding but the visuals are very crisp and the action sequences are well fleshed-out. No, not every adaptation needs to rigidly follow the plot of a video game. I'm here for an expanded experience, not to rehash a plot with which I'm already familiar.

That said, forget the helmet - dude needs to spend more time wearing pants.

Comment Re: Their website is absolute garbage. Don't bothe (Score 1) 29

Well, unless the auth data somehow includes a hash of the N most recently-reported stick positions, you could ostensibly build a device that basically MITMs the link between the stock controller and the console. The difficulty would depend on where Sony has bolted on the auth, and how stringent the console is about corner-case differences (or things like round-trip latency). I also feel that MITMing USB could be done at multiple layers, each with their own challenges. You could intercept/modify/inject endpoint messages, or actually implement your own host stack and do a very high-level passthrough of HID data. Or anything in between.

Comment Their website is absolute garbage. Don't bother (Score 1) 29

Tried to go read about this thing. The website contains more sticky elements than a glue trap. Yeah, basically it's a USB HID device. I wonder what prevents someone from cloning the official controller's VID/PID? I guess there might be some form of auth on top of that? Worst case, gut a real PS5 controller and feed whatever you want to the analog inputs, but of course this gets a lot more expensive to manufacture.

Comment I'll go ahead and state the obvious (Score 2) 166

This is HP giving itself a black eye and intentionally trying to pass it off as trendy new make-up.

If it's possible to infect a network via an ink cartridge, that is not the fault of the cartridge, but of HP's *profoundly* shitty firmware, if that firmware reads data from the cartridge and treads that data as if it were trusted. The whole *point* of talking to the cartridge is to interrogate it and confirm that it is genuine. By its very nature, this problem requires the printer to communicate with an untrusted device (the cartridge) and validate its response. If you cannot do this without hitting some sort of buffer overflow or code execution vulnerability, then you have failed. Miserably. Completely.

Even *if* this demo somehow convinces to intentionally only buy what you believe is "genuine HP" crap, this demo *still* show how vulnerable HP's printers are to a supply chain attack. And we know those are not uncommon.

If I cared about printing, I would pick up one of these printers and see if it's possible to root the firmware using a carefully-crafted cartridge payload, then patch the firmware to skip the auth checks once and for all.

Fun fact, a week ago I was trying to get my mother's Epson to accept aftermarket ink, which resulted in discovering Linux and Busybox in the printer's firmware (GPL request sent, awaiting reply). But that's just the "connectivity" portion of the printer (wifi and such); the actual printing / cartridge / UI junk probably runs in a separate execution domain. This article is starting to give me ideas.

Comment A subscription for not being a shitbag? No thanks (Score 1) 100

So wait a minute. You buy the hardware (paying upfront) and you _then_ must pay them a monthly fee to essentially hide your data/actually from prying eyes? What happens if you stop paying? Do the partitions come crashing down and suddenly the last year's worth of activity gets exposed for Google/others to see? How does this work exactly? It seems there already exist open-source alternatives, minus the rent-seeking and without the obligatory Adobification of cloud bullshit that nobody wanted in the first place.

Comment There's an obvious solution here (Score 1) 150

Sounds like Ubisoft needs to become a lot more comfortable with people pirating the very few decent things they make. Worked for an adventure company for a while. Got an invite for an adventure game after the company partnered with Ubisoft. Took four days to get Uplay working on my machine. By the time we got it working, the damn demo had expired..lool.

Comment Even the base execution is garbage (Score 5, Insightful) 259

When was the last time someone actually opened the Amazon Prime app? It's unusable. Cluttered beyond belief, with ads and basically more subtle versions of ads. I have a hard time understanding the driving factors behind making the landing page (and all aspects of the UI) so terrible, considering I'm already paying for the service! What's with the clutter? Trying to further improve engagement? On top of that, I may know someone who pirates all their Amazon Prime content despite paying for it, because the Prime Video app (both on Android and on Roku) is really that terrible, and not just in terms of navigation, but playback as well. Don't even bother trying to open it on a Fire TV of all things - it's somehow even worse.

Comment Re:Somebody has too much faith in humanity (Score 2) 68

I think you are almost right.

Bitcoin is regulated because naive people fell in with crypto bros and were very predictably scammed. You could have predicted the hype -> scam -> regulation chain of causality from a thousand miles away.

Sending a fax from the beach was never going to liberate you from work. Technology did not create the base corporate forces that aim to extract every last drop of blood from the cogs in the machine, but it provided more efficient ways of doing so. On the plus side, we have remote work / hybrid work, which is kind of nice. I went to visit my family across the country. It was supposed to be two weeks of vacation and one week of remote work. I ended up staying for an entire YEAR (with my manager occasionally sending me new dev boards to work on). For this, we thank broadband (and ssh).

But for the most part, I think you are right.

Comment Re: Fundamentally no way to win this one (Score 2) 109

Date and location can be spoofed using a GPS simulator. This is a device that generates a fake GPS signal for a given date/time/location/trajectory. Connect an antenna to it and point it at the camera. Select constellation type. Put in a date and some cooridinates. Then point camera at studio or screen.

Will the photo auth technology raise the barrier for passing off faked RAWs as genuine? Yes. Will it actually provide assurance that a photo is of what is being claimed? Absolutely not.

Then again, that's not the real problem here. People on Facebook can't even be bothered to use even the most basic verification tools (snopes,. reverse image search, second source) before believing or spreading unsubstantiated garbage. Even less so, when said garbage panders to (or supports) their existing biases, opinions, or agendas.

Comment Fundamentally no way to win this one (Score 2) 109

There's a huge long tail on ways to defeating the fundamental idea here. Some are more silly than others, but still. I've had to deal with this problem for a while, and fundamentally there is no way for a camera to be able to authenticate an image with full certainty, since there is no way to establish a root of trust that is rooted in the real world.

What will happen if I display an AI-generated image on a large TV screen, then take a carefully-framed photo of that screen?

What about GPS? GPS simulators (with time/date/trajectory replay) are a bit pricey (it's a somewhat niche market) but they definitely exist.

As for the date/time... unless the camera sets the date/time via GPS, *and* that signal is somehow authenticated (which it isn't, in the civilian world), *and* the camera implements some kind of anti-rollback protection for the RTC, this is going to be a tough one at best (and it's arguably the least interesting piece of metadata to protect).

And even then, what are the digital signatures really proving? That the given scene was captured by the camera? So what? I could project a mural onto a white wall, or hire actors, etc.

Slashdot Top Deals

Always draw your curves, then plot your reading.

Working...